1. Field of the Invention
The present invention relates generally to virtual machine environments, and more specifically to monitoring virtual machines.
2. Background Description
A virtual machine is a logical partition or share of the resources (including CPU, memory, I/O, etc.) of a real computer. One or more computer programs (such as applications and a “guest” operating system to control execution of the applications in its virtual machine) execute in each virtual machine such that the computer programs executing within each virtual machine execute with the resources allocated to the virtual machine. Each computer program executes in a virtual machine in a similar manner to executing on a real computer. A control program or base portion of a virtual machine operating system forms the virtual machines by partitioning or allocating the share of computer resources to each virtual machine, and also can start and stop virtual machines and serve as a communication pathway between virtual machines. One purpose of a virtual machine environment is to separate the computer programs executing in different virtual machines from each other and divide the resources between them. Another purpose is to allow different guest operating systems to execute in the same real computer. Software implementation of a data processing system and may execute programs just like a real data processing system. A virtual machine may take the form of a complete system platform that executes a computer operating system. Software running on a virtual machine is limited to accessing resources and other abstractions provided by the virtual machine.
Virtual machines have many uses. For example, a virtual machine may be used as a sandbox for an operating system that is not trusted or an operating system that is under development. A virtual machine also may provide instructions and architecture that is somewhat different from that used by the physical data processing system on which the virtual machine executes. Further, in developing operating systems, virtual machines provide faster debugging access and faster reboots. Virtual machines are also employed to run multiple operating systems on a data processing system. In this manner, a single computer may be time shared between several operating systems.
Virtual machine introspection (VMI) provides capabilities to monitor and alter the state of a virtual machine. This type of introspection may be used to observe the execution of operating systems. This type of technique may be used to introspect information about the state of another virtual machine running in the context of an isolated execution environment. Introspection involves obtaining a view of resource state for one or more virtual machines executing on a computer without accessing the virtual machine itself. Introspection includes, for example, obtaining information about, for example, memory usage and processor state by a particular virtual machine.